CVE-2026-89693: nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()
In the Linux kernel, the following vulnerability has been resolved:
nfsd: check nfsd4acltoattr() return value in nfsd4create()
nfsd4create() stores the return value of nfsd4acltoattr() in status, but the switch(create->crtype) block unconditionally overwrites it in every branch. ACL translation errors are silently discarded, and the CREATE proceeds without the requested ACL.
Add an early exit check after nfsd4acltoattr(), matching the pattern already used in nfsd4setattr().
[ cel: prefer NFS4ERRBADTYPE over NFS4ERRATTRNOTSUPP ]
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
An NFSv4 CREATE operation must include an ACL that causes nfsd4_acl_to_attr() to return an error. The vulnerable path then overwrites that error and may create the object without the requested ACL.
What is the practical impact of the error being discarded?
The CREATE operation can proceed despite failure to translate the requested ACL, leaving the newly created object without that ACL. This can result in permissions differing from those requested by the NFS client.
How can I identify potentially affected objects?
Review objects created through NFSv4 CREATE requests that specified ACLs, particularly where clients may have supplied ACLs unsupported by the server. The provided information does not describe a definitive audit log or on-system detection method.